From 40e8b283e6d91a84797e34796702e60f8d231a16 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Thu, 22 Jul 2010 19:09:08 +0000 Subject: [PATCH] --- yaml --- r: 203744 b: refs/heads/master c: fed66381d65a35198639f564365e61a7f256bf79 h: refs/heads/master v: v3 --- [refs] | 2 +- trunk/include/linux/skbuff.h | 3 ++- trunk/net/core/skbuff.c | 2 +- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/[refs] b/[refs] index a553ba5791c6..b643a9835b70 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: c1f79426e2df5ef96fe3e76de6c7606d15bf390b +refs/heads/master: fed66381d65a35198639f564365e61a7f256bf79 diff --git a/trunk/include/linux/skbuff.h b/trunk/include/linux/skbuff.h index f5aa87e1e0c8..d89876b806a0 100644 --- a/trunk/include/linux/skbuff.h +++ b/trunk/include/linux/skbuff.h @@ -202,10 +202,11 @@ struct skb_shared_info { */ atomic_t dataref; - skb_frag_t frags[MAX_SKB_FRAGS]; /* Intermediate layers must ensure that destructor_arg * remains valid until skb destructor */ void * destructor_arg; + /* must be last field, see pskb_expand_head() */ + skb_frag_t frags[MAX_SKB_FRAGS]; }; /* We divide dataref into two halves. The higher 16 bits hold references diff --git a/trunk/net/core/skbuff.c b/trunk/net/core/skbuff.c index 76d33ca5f037..7da58a25ad92 100644 --- a/trunk/net/core/skbuff.c +++ b/trunk/net/core/skbuff.c @@ -817,7 +817,7 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail, memcpy(data + nhead, skb->head, skb->tail - skb->head); #endif memcpy(data + size, skb_end_pointer(skb), - sizeof(struct skb_shared_info)); + offsetof(struct skb_shared_info, frags[skb_shinfo(skb)->nr_frags])); for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) get_page(skb_shinfo(skb)->frags[i].page);